CVE-2026-56264: Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint
Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /executejs endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser's relaxed security settings, perform server-side request forgery against internal services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crawl4AIto a version that resolves this vulnerability.Fixed in 0.8.7 - Configuration
Ensure the Docker API server/browser is not started with --disable-web-security enabled so the /execute_js endpoint cannot execute arbitrary JavaScript with relaxed browser security.
Docker API server (/execute_js endpoint) in Crawl4AI --disable-web-security = enabled -> disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56264?
CVE-2026-56264 has a severity score of 9.2, classified as critical.
How do I fix CVE-2026-56264?
To mitigate CVE-2026-56264, it is recommended to upgrade Crawl4AI to version 0.8.7 or later.
What kind of attack is possible with CVE-2026-56264?
CVE-2026-56264 allows attackers to execute arbitrary JavaScript in the server's browser context due to insecure handling of user input.
In what version of Crawl4AI is CVE-2026-56264 present?
CVE-2026-56264 is present in Crawl4AI versions prior to 0.8.7.
What component of Crawl4AI is affected by CVE-2026-56264?
CVE-2026-56264 affects the /execute_js endpoint of the Docker API server.